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The submitted invention covers an expanded electronic use of the existing and future 
debet-Zcredit/customer cards (national and international) as secure means of payments 
for shopping on the Internet The name Internet will in the following designate the In- 
ternet, other public- or semipublic networks, private or semiprivate networks. 

The existing debet/credit/customer cards, issued by the many national or international 
cardcompanies, are today used as means of payment for shopping on the Internet. 
However, the use of these cards are still connected with a certain risk for fraud. Today, 
several different, tecnical solutions have been developed to minimize the risk (SSL, 
SET and others), but these solutions are characterized by their complexity and incon- 
venience, and the result is, that the users of debet/creditcards are still very reluctant to 
use the cards on the Internet. 

The objective for the described invention is to eliminate the before mentioned risk for 
fraud, and to develope a simple, easy and cheap solution to the security problems, 
which will dramatically increase the use of debet/credit/customercards as secure means 
of payments on the Internet. 

The invention covers the use of a virtual (non-physical), electronic debit/credit/custom- 
ercard, constructed electronically the same way as the existing, physical cards, but the 
virtual, eSectromk card is onnly valid as locng as tDne electronnic verificationi/payimienlt 
is processed, whereupon the virtual card is made invalid amid cease to exist. 
The virtual card works as a once-only card, and can contain the precise amount to be 
paid, a maximum amount to be bought for, or it can be used as a "small-coins" card. 

The invention has several fields of application as listed below: 

1) Secure means of payment on the Internet provided that the person in question alrea- 
dy has a physical, valid debet/credit/customercard. 

2) As secure means of payment on the Internet without the person in question poses- 
sing a physical debet/credit/customercard. 

3) As secure means of payment on the Internet with/without a physical customercard 
issued by e.g. department stores, supermarkets, postalorder companies, gasoil com- 
panies, business chains etc. which wants their customers to buy products/goods on 
the Internet. 

4) As identification of a person/company to another person/company as the invention 
inherently contains a identification process. 



The above mentioned fields of application must however in no way be considered 
as being linmited to these, as new fields of application cam be constructed based on 
tbe invention. 



AD. 1: As secure means of payment on the Internet provided that the person in 
question already has a physical valid debet/cred it/customer card 

A precondition for use of the virtual, electronic card is (in this case), that the person, 
who wants to pay with a debit/credit/customercard on the Internet, already has a 
physical, valid debit/credit/customer card. 

The virtual electronic card is issued on-line by the cardcompanies sysems or the card 
company's Intemetbank, and the virtual cardnumber is send on-line, electronically to 
the person, who wants to make a payment on the Internet. This can be done by the cu- 
stomer instructing the cardcompany, that he wants to be able to pay on the Internet. 
Can suitable be made the following way: 

1 . At the time when a new, physical card is issued or renewed. 

2. An existing cardholder instructs the cardcompany or the Intemetbank, that he/she 
wishes to be able to pay on the Internet. 

When 1 or 2 above is done, the cardholder will receive the ID's and passwords, 

etc., necessary for accessing the cardcompany's system or Intemetbank (if this has not 

already been done when the cardholder was established as an Intemetbank customer). 

When the cardholder wants to make a payment on the Internet, he connects to the 
cardcompany's system/Internet bank, selects the menu e.g. "Internet Payment", and he 
then receives a virtual cardnumber and an expire date. At this point, the particular 
virtual cardnumber is marked in the database as a valid cardnumber issued to the 
cardholder and it is also time-stamped (date, hour, min. sec.), to give a complete un- 
ambiguous identification. 

The virtual cardnumber and expire date are now used directly to carry out the pay- 
ment for goods bought at an Internet-shop. When the verification-process anil/or the 
final payment process is finished or if a specified amount of time has passed without 
the card/cardnumber has been used , then the virtual cardnumber is made invalid in the 
card database. The virtual, electronic card acts as a once-only card. 
A copy of the cardnumber together with all relevant data is made (log-file), as docu- 
mentation for the payment/not used virtual cards. 

The invention is based on the idea, that the cardnumber which is issued to the virtual 
card, is taken from the pool of free cardnumbers, normally used when issuing new, 
physical cards. As the person, who wants to make a payment on the Internet already 
has a valid, physical card, then there is no need to go through the normal application 
procedure. Therefore it is safe to send the virtual cardnumber directly (electronically) 
to the customer via the Internet. It is only the virtual cardnumber and expire date, 
which is used, to make the payment. The virtual cardnumber will, to the different 
computersystems involved look exactly like a normal, valid physical card issued 
to the person/customer, which means no change to the existing infrastucture. 



When the payment has taken place, the virtual cardnumber is placed as the last, free 
cardhumber in the card database. In effect, the pool of free, physical cardnumbers is 
dynamically used as virtual cardnumbers. 

The fact, that the use of virtual cardnumbers, which in contents and stucture already 
follows the agreed standards for the different debit/credit/customercard systems, and 
as it is merely an activation of a card (like issuing a new, phycical card), results in the 
great advantage, that the receiving computer systems need not to be changed. 

The invention can be used by all existing and future cardcompanies all over the world, 
and can be implemented successively by the different cardcompanies. There is no way 
the virtual card can be tampered with, as each card is individual identifiable and as 
such can be regarded as a "once-only"- card or as a disposable card. The virtual card 
exists and is valid o sully during the payment process. 

AD 2. As secure means of payment on the Internet without the person in question 
having a physical debet/credit/crastoranier card. 

As the invention is based upon the fact that the person who wants to make an Internet 
payment must connect to his cardcompay's system/Intemetbank, then it is implicit that 
the person already is known and accepted as customer of the system in question. 
This already established customer relationship can be used to give the customer (or 
certain customer groups) the opportunity to pay on the Internet without any physical 
debit/credit/customercard. The system/the Internet bank in question is able to marie 
the customers in their database, who are allowed to pay on the Internet without ha- 
ving a physical card issued. When such a customer connects to the cardcompany- 
/Internet bank and reaches the menu point e.g. 'Internet Payment" the system checks, 
if this particular service is valid for this customer, if yes, the system makes the same 
procedures as if the person already had a physical valid card. This means that a 
virtual cardnumber and expire date are returned as described under 1) (the expire date 
will in this case be todays date or a system dependent date). 

AD 3. As secure means of payment odd the Internet with/without a physical custo- 
nnercard issued by e.g. department stores, supermarkets, postalorder conn panes, 
gasoil companies, business chains etc., which wants their customers to be able to 
buy products/goods on the Internet. 

The invention can be used in connection with all kind of customercards where the 
customer is identified by a cardnumber. The cardcompany- system must have the same 
functionality as the Intemetbank system as described under fields of application 1). 
This means that the cardcompany must have a system (equivalent to a Intemetbank sy- 
stem), which can be accessed via the Internet. Furthermore the cardcompany must also 
have an invoicing system at his disposal in order to invoice the customer for the purr 
chases made with virtual customercard. 



AD 4: As identification of a person/company to another person/company as the 
invention inherently contains an identification process. 

As the invention is based upon the fact that the customer is approved by a bank or a 
cardcompany, which gives the customer the possibility to pay on the Internet with 
virtual debit/credit/customercard, then it is possible, that 2 persons/companies can 
identify themselves to each other by making fictive payments to each other using vir- 
tual debit/credit/customercards. This can be of great importance for B2B commerce. 

In general. 

In general, the invention covers situations, where x number of persons are identifiable 
via a number (f.ins. a cardnumber) in a database or similar construction. It is necessa- 
ry, that x is a relative high number and that there is free numbers available, x can be 
calculated in each particular situation. 

The invention can then be applied, when the persons mentioned above wants to carry 
out a function on the Internet normally based on the identification-number (normally a 
cardnumber), but the function can be carried out totally secured, based on the use of a 
virtual number (as described earlier). 

The invention can change the existing use of physical debit/credit/customercards as 
means of payment on the Internet, as the invention carries the possibility to introduce 
the ultimative, global virtual paymentsystem for the Internet. The customers can be 
identified by a international/global numbersystem (like the international creditcard 
numbers), but without issuing a physical card. The payment transactions will then be 
carried out solely based on virtual cards. 

The invention can be exploited by and covers all kinds of electronic equipment 
which now and in the future can connect to the Internet, this means all kinds of 
electronic equipment, computer systems, PC's, mobile telephones, wireless tele- 
phones combined with all kinds of debet/credit-/customercards. The potential for 
the use of virtual, electronic debit/credit/customer cards as secure means of pay- 
ment on the Internet, is estimated to be tremendous. 



(see page 9 for an overview). 



CLAIMS. 



1 . Electronic debit/credit/customer cards used for payments on the Internet or other 
non-secure network, characterized by the fact, that it is virtual cards. 

2. Virtual, electronic debit/credit/customer cards, according to claim 1), characterized 
by the fact that the structure of the cards and cardnumbers is either identical to the 
structure (in the card database and/or in the computer systems behind), which al- 
ready now is used by the existing national or international cardissuing-companies, 
or a subset of their structure. 

3. Virtual, electronic debit/credit/customer cards, according to claim 1) and 2), char- 
acterized by the fact that the individual virtual card's number is taken as one of 
the free numbers from the pool of free card numbers which are used for issuing 
new physical debet/credit/customer cards at the cardcompany in question. 

4. Virtual, electronic debit/credit/customer cards, according to claim 1), 2) and 3), 
characterized by the fact that the virtual card is marked in the card database as valid 
and in use by the customer in question (like establishing a new debit/credit/custom- 
er card). The expire date for the virtual card is equivalent to the expire date of the 
physical card the customer already holds. 

5. Virtual, electronic debet/credit/customer cards according to claim 1), 2), 3) and 4) 
characterized by the fact that the individual card is uniquely identified (cardnumber 
+ year, month, day, hours, min., sec.). 

6. Virtual, electronic debet/credit/customer cards according to claim 1), 2), 3), 4) and 
5) characterized by the fact that the cardcompany' s system or Internet-bank issues 
the virtual cards (on-line via the Internet) on demand. This means that when the 
customer wants to pay on the Internet and asks for a virtual card, then a virtual 
cardnumber is returned and an expire date. At the same time an electronic logging 
of all relevant data (the customer, the virtual cardnumber, time, etc.) is made in or- 
der to prove, that the virtual card has been issued. 

7. Virtual, electronic debet/credit/customer cards according to claim 1), 2), 3), 4), 5) 
and 6) characterized by the fact that the individual card is only valid/exists in the 
moment of payment/process of payment. This means that when the virtual card is 
used as payment on the Internet it is made un valid in the card database the moment 
the authorization and/or payment process is ended. Before, an electronic logging of 
all the necessary data is made, to prove the completion of the payment. 



8. Virutal, electronic debet/credit/customer cards according to claim 1), 2), 3), 4), 5), 
6) and 7) characterized by the fact that if the virtual card is not used within a speci- 
fic time- lapse (chosen by the cardcompany) or the purchase for some reason was 
not completed, the virtual debet/credit-/customer card is made invalid (marked in 
the card database as invalid) and an electronic logging of the necessary data, as do- 
cumentation, is executed. 

9. Virtual, electronic debet/credti/customer cards according to claim 1), 2), 3), 4), 5), 
6), 7) and 8) characterized by the fact that when the payment has been effected, the 
virtual card will be invalid and the virtual cardnumber will be placed behind the 
others in the pool of free cardnumbers, which are used to issue new, physical de- 
bet/credit/customercard. This means that the pool of free cardnumbers in the diffe- 
rent cardcompanies* systems the whole time dynamically are used for virtual de- 
bet/credit/customer cards concurrently with the demand for payments on the Inter- 
net. 

10. Virtual, electronic debet/credit/customer cards according to claim 1), 2), 3), 4), 5), 
6), 7), 8) and 9) characterized by the fact that the virtual electronic card can also be 

used by persons who do not possess a physical valid debet/credit/customer card. 

The card company's system or Internet bank must have an approved supplier/cu- 
stomer relationship e.g. being customer in a bank. The bank must in the range 

of services have the possiblity that the customer or certain groups of customers are 
offered the possibility of payment on the Internet via a virtual card issued by the 
card company's Internet system or Internet bank without a physical card being 
issued. 

1 1 . Virtual, electronic debet/credit/customer cards according to claim 1), 2), 3), 4), 5), 
6)> 7), 8), 9) and 10) characterized by the fact that the customer X as stated in 
claim 6) has a virtual cardnumber electronically transferred. This virtual cardnum- 
ber can be used by customer X to make a Active payment to Y. If Y gets an OK for 
the payment, then X will be a known and accepted customer at the card company. 
A similar payment from Y to X will make Y a known and accepted customer at the 
card company. In this way two companies unknown to each other can make sure 
that both are known and accepted by the card company (often a bank). 
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SUMMARY. 

Virtual, electronic debit/credit/customercard payments on the Internet or other non- 
secure network. 

The submitted invention concerns an expanded electronic use of existing and future 
5 debit/credit/customer cards (national as well as international), as secure means of 

payment for buying goods on the Internet. 

The invention concerns the use of virtual (not physical), electronic debit/credit/custo- 
mercards, electronically build and shortly electronically connected to the existing issu- 
ed cards. But the virtual, electronic debit/credit/customer card exist only as long as the 
10 payment process takes place, whereupon the virtual card is invalid and cease to exist. 

A precondition for use of the virtual, electronic debit/credit/customercard is normally, 
that the person who wants to pay on the Internet, already has a valid, physical debit/ 
credit/customercard. But the invention also open up the prospect of paying on the In- 
ternet without a physical card being involved. 

The virtual, electronic debit/credit/customercard is issued on-line of the existing or 
fiiture cardcompanies. The person, who wants to make payments on the Internet, con- 
nects to the system of the card company/Intemet-bank, wherefrom he/she already pos- 
sesses a physical card (or has an already established customer relationship) and indi- 
cates that he/she wants to make a payment on the Internet. The system will return a 
virtual debit/credit/customer cardnumber and expiring date, which will be used for the 
payment. The virtual cardnumber is taken from the pool of free cardnumbers used for 
issuing of new, physical cards from the particular cardcompany. 
When the payment is finished, the virtual cardnumber is made invalid and the number 
will return to the pool of free cardnumbers (as the last). This means that the virtual 
card operates and can be looked upon as a once-only card. 

A log of the cardnumber together with relevant data is taken before, to prove that the 
payment has taken place. In general, an electronic log of all relevant data must be tak- 
en at all critical places in the system. 



20 
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OVERVIEW 



Customers 




or other systems 
with same func- 
tionality (e.g. Shell, 
Statoil, etc.) 



Internet-shop 



Cardsy stern 




Carddatabase 



Used as 
virtual cards 
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Functional Transaction-flow 



Customer 



The customer connects to an Internet-bank or a similar system 
(e.g. issuing cardcompany-system). 

He selects the ikon "Internet Payment" and the system will return a 
list of the different debit/credit/customercards the customer has, and 
he then selects the debit/credit/customercard he wants to use for this 
particular payment. 



Internet-bank 



An on-line transaction is created^ which contains all relevant data 
for identifying the customer (the system has already the relevant 
data). The transaction is constructed in such a way, that it will 
look like a request for issuing a new card. The transaction is now 
send.to the system, which has the debit/creditcard database. 



D 



The receiving system^ which contains the debit/credit-card data- 
base, will now issue a virtual card. 

This is done the same way as when issuing a new physical card. 
The cardnumber is taken from the pool of free cards. The cardnum- 
ber is marked in the database as being in use by. the customer, 
Cardsystem and a timer is activated. The expiringdate is set equal to the 

expiringdate of the customers already issued physical card. An 
on-line transaction is created containing the virtual cardnumber 
together with the expiringdate, and is send back to the Internet- 
bank. 



The Internetbank-system, when receiving the transaction, will 
present for the customer the virtual debit/creditcardnumber and 
the expiring date. 

Internet-bank 




Virtual cardnumber and expiringdate is received by the customer. 



Customer 
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I Customer 

T 




^ Internet-shop 

mo 

I Cardsystem 




^ Internet-shop 
Bank i Bank 



Cardsystem 



The customer can now use the virtual cardnumber and the expiring- 
date for buying goods from an Internet-shop (merchant). The custo- 
mer will normally have been into the Internet-shop beforehand, 
and marked the items which he wants to buy. 
He will key-in the requested data and the virtual debit/creditcard 
number and expiring date. 



The Internet-shop receives the data and will process the data as usual. 
The Internet-shop system cannot see the difference between the vir- 
tual cardnumber and a normal, physical cardnumber. 
A verification transaction is now send to the issuing cardsystem 
(e.g. VISA), as usual. 



The system which has the debit/creditcard database, receives the 
verification transaction from the Internet-shop, and will verify, that 
the received data (incl. cardnumber and expiringdate) are valid. 
The timer will be set to 0 (zero) and deactivated. 



An OK-transaction will be send back to the Internet-shop. 



Settlement-transactions will be send between the relevant systems 
as usual. 



When the settlement-transactions have taken place, the virtual debit/ 
credit cardnumber will be deactivated and will be placed as a free 
debit/creditnumber in the carddatabase. 



